Atlas / MCP servers / samuelgursky / DaVinci Resolve

DaVinci ResolveBLOCK

Name: DaVinci Resolve
Author: samuelgursky

mcp/samuelgursky/davinci-resolve-1

MCP server by samuelgursky · blackmagic · blackmagic design · blackmagicdesign · Audited 2026-09-23

⚑ Report / re-scan Source ↗

MCP server integration for DaVinci Resolve Studio

Verdict

BLOCK

Grade

Trust score

50 /100

Exposed tools

200 187r · 83w · 2d

Transport

stdio · streamable-http

License

MIT

Stars

3,080

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

English | 简体中文

[](https://github.com/samuelgursky/davinci-resolve-mcp/releases) [](https://www.npmjs.com/package/davinci-resolve-mcp) [](docs/reference/api-coverage.md) -blue.svg) -18%20tools-blueviolet.svg) [](docs/reference/api-coverage.md#test-results) [](https://www.blackmagicdesign.com/products/davinciresolve) [](https://www.python.org/downloads/) [](https://opensource.org/licenses/MIT)

A Model Context Protocol (MCP) server that lets AI assistants control DaVinci Resolve Studio through the official Scripting API. It provides full API coverage plus guarded workflow helpers for editing, media pool organization, render setup, review markers, grading, Fusion, Fairlight, project lifecycle tasks, extension authoring, and source-safe media analysis.

[](docs/guides/control-panel.md)

A local browser control panel ships with the server for inspecting Resolve state, running source-safe analysis, drilling into analyzed clips and shots, and editing analysis output inline. See the Control Panel Guide for the full tour.

Quick Start

npx davinci-resolve-mcp setup

Before connecting, ope

Read from source at commit ba56de95aba0OBSERVED · 2026-09-23

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add drt-format --env DAVINCI_MCP_TOKEN=${DAVINCI_MCP_TOKEN} --env PGPASSWORD=${PGPASSWORD} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "drt-format": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "DAVINCI_MCP_TOKEN": "${DAVINCI_MCP_TOKEN}",
        "PGPASSWORD": "${PGPASSWORD}"
      }
    }
  }
}

Exposed tools (200)

187 read · 83 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`Documentary`	read	Interview-driven documentary with natural sound and music
`Dreamy`	read	Soft, low-contrast with lifted blacks and gentle warmth. Ethereal mood.
`Ektachrome`	read	Vivid blues, punchy contrast. Cross-process reversal feel.
`Kodachrome`	read	Rich, saturated with warm midtones and slightly lifted blacks. Iconic reversal film.
`Moonlight`	read	Cool blue shadows, desaturated. Night exterior mood.
`Offset`	read	True exposure compensation - affects entire image equally
`Podcast`	read	Multi-host podcast with music beds
`Vérité`	read	Raw, natural feel with slight lift. Observational documentary aesthetic.
`add_clip_flag`	write	Add a flag to a Media Pool clip.
`add_clip_marker`	write	Add a marker to a Media Pool clip.
`add_clip_mattes_to_media_pool`	write	Add clip mattes from Media Storage to a MediaPoolItem.
`add_color_group`	write	Create a new color group in the current project.
`add_items_to_media_pool_from_storage`	write	Add specified file/folder paths from Media Storage into current Media Pool folder.
`add_keyframe`	write	Add a keyframe at the specified frame for a timeline item property.
`add_render_job`	write	Add a render job based on current render settings to the render queue.
`add_subfolder`	write	Create a new subfolder in the current Media Pool folder.
`add_timeline_mattes_to_media_pool`	write	Add timeline mattes from Media Storage to a timeline item.
`analyze_clip_for_intellisearch`	write	Run IntelliSearch analysis on a clip (Resolve 21+, requires AI IntelliSearch Extra).
`analyze_clip_for_slate`	write	Run Slate analysis on a clip (Resolve 21+, requires AI Slate ID Extra).
`append_to_timeline`	read	Append clips to the current timeline.
`apply_fairlight_preset_to_current_timeline`	write	Apply a Fairlight preset to the current timeline.
`attenuate_lut_file`	write	Blend an existing .cube toward identity and install the result.
`audio`	read	Offline audio ops via system ffmpeg/ffprobe (must be on PATH — not bundled, FFmpeg is GPL;
`audio_plan`	read	Fairlight audio track planning + coverage/loudness analysis — offline, pure Node. Actions: list_templates, select_template, track_plan, analyze_coverage, check_loudness.
`auto_sync_audio`	write	Sync audio across multiple clips.
`capabilities`	read	Report available vs. setup-needed features. The core is pure-JS (always works); audio needs ffmpeg on PATH, conform.verify needs sharp, fairlight DB path needs better-sqlite3. Action: get.
`conform_qc_package`	read	Build a deliverable package (media mode × formats {otio,fcp7Xml,aaf,drp}) + V2 flag track + provenance manifest from a conformed timeline.
`conform_qc_verify`	write	Run the read-only verify pass over a conform model (parse->oracle->reference->compare->report).
`create_cloud_project_tool`	write	Create a new cloud project.
`create_gallery_power_grade_album`	write	Create a new gallery power grade album.
`create_gallery_still_album`	write	Create a new gallery still album.
`create_project`	write	Create a new project with the given name.
`create_project_folder`	write	Create a new folder in the current project folder location.
`create_stereo_clip`	write	Create a stereo clip from left and right eye clips.
`create_timeline`	write	Create a new timeline with the given name.
`create_timeline_from_clips`	write	Create a new timeline from specified media pool clips.
`describe_resolve_api`	read	Full typed detail for one Resolve API symbol. Needs no connection.
`disable_background_tasks_for_current_session`	write	Disable all background tasks for the current Resolve session (Resolve 21+).
`enable_keyframes`	write	Enable keyframe mode for a timeline item.
`encrypt_dctl_native`	read	Encrypt a .dctl to a new .dctle using Resolve 21.1. Never overwrites. Empty/null expiry means no expiry; ISO 8601 strings pass to Resolve. Source is unchanged.
`export_burn_in_preset`	read	Export a burn-in preset to a file.
`export_current_frame_as_still`	read	Export the current frame as a still image.
`export_folder`	read	Export a folder to a DRB file or other format.
`export_layout_preset_tool`	read	Export a layout preset to a file.
`export_media_pool_metadata`	read	Export metadata of clips in the current Media Pool folder to a CSV file.
`export_project_to_file`	read	Export a project to a .drp file.
`export_render_preset`	read	Export a render preset to a file.
`export_stills_from_album`	read	Export stills from a gallery album.
`export_user_preferences_preset`	read	Export a user-preferences preset to a file (Resolve 21.0.4+).
`folder_analyze_for_intellisearch`	write	Run IntelliSearch analysis on all clips in a folder (Resolve 21+, requires AI IntelliSearch Extra).
`folder_analyze_for_slate`	write	Run Slate analysis on all clips in a folder (Resolve 21+, requires AI Slate ID Extra).
`folder_export`	read	Export a Media Pool folder to a file.
`folder_perform_audio_classification`	read	Classify audio of all clips in a Media Pool folder into categories (Resolve 21+).
`folder_transcribe_audio`	read	Transcribe audio for all clips in a Media Pool folder.
`fusion`	read	Declarative Fusion composition (.comp) authoring — offline, no Resolve required. Actions: generate, generate_from_template, list_templates, to_api_calls.
`generate_speech`	write	Generate AI text-to-speech audio and add it to the media pool (Resolve 21+).
`get_album_stills`	read	Get list of stills in a gallery album.
`get_audio_render_codecs`	read	Read GetAudioRenderCodecs (documented on Resolve 21.1+). Pass an audio file extension such as wav.
`get_audio_render_formats`	read	Read GetAudioRenderFormats (documented on Resolve 21.1+).
`get_burn_in_preset_list`	read	Get the names of all saved data burn-in presets (Resolve 21.0.4+).
`get_clip_audio_mapping`	read	Get audio mapping for a clip.
`get_clip_color`	read	Get the clip color of a Media Pool item.
`get_clip_flag_list`	read	Get list of flags on a clip.
`get_clip_mark_in_out`	read	Get mark in/out points for a clip.
`get_clip_marker_by_custom_data`	read	Get a marker by its custom data string.
`get_clip_marker_custom_data`	read	Get the custom data of a clip marker at a specific frame.
`get_clip_markers`	read	Get all markers on a Media Pool clip.
`get_clip_matte_list`	read	Get list of clip mattes for a MediaPoolItem.
`get_clip_media_id`	read	Get the media ID for a clip.
`get_clip_metadata`	read	Get metadata for a Media Pool clip.
`get_clip_property`	read	Get a property of a Media Pool clip.
`get_clip_third_party_metadata`	read	Get third-party metadata for a clip.
`get_clip_timeline`	read	Resolve a Media Pool timeline entry to its timeline summary (Resolve 21.0.4+).
`get_clip_unique_id_by_name`	read	Find a clip by name and return its unique ID.
`get_color_group_clips`	read	Get clips in a color group for the current timeline.
`get_color_group_post_clip_node_graph`	write	Get the post-clip node graph for a color group.
`get_color_group_pre_clip_node_graph`	read	Get the pre-clip node graph for a color group.
`get_color_groups_list`	read	Get list of all color groups in the current project.
`get_current_database`	read	Get information about the current database.
`get_current_keyboard_preset`	read	Read GetCurrentKeyboardPreset (documented on Resolve 21.1+).
`get_current_project_folder`	read	Get the name of the current project folder.
`get_current_render_format_and_codec`	read	Get the current render format and codec setting.
`get_current_render_mode`	read	Get the current render mode (0=Individual Clips, 1=Single Clip).
`get_current_still_album`	read	Get the current still album.
`get_database_list`	read	Get list of all available databases.
`get_fairlight_presets`	read	Get the available Fairlight preset names.
`get_folder_clip_list`	read	Get list of clips in a Media Pool folder.
`get_folder_is_stale`	read	Check if a Media Pool folder is stale (needs refresh).
`get_folder_subfolder_list`	read	Get list of subfolders in a Media Pool folder.
`get_folder_unique_id`	read	Get the unique ID of a Media Pool folder.
`get_fusion_comp_by_name`	read	Get a Fusion composition from a timeline item by name.
`get_fusion_object`	read	Get the Fusion object. Starting point for Fusion scripts.
`get_gallery_album_name`	read	Get the name of the current gallery album.
`get_gallery_power_grade_albums`	read	Get list of all gallery power grade albums.
`get_gallery_still_albums`	read	Get list of all gallery still albums.
`get_keyboard_presets`	read	Read GetKeyboardPresetList (documented on Resolve 21.1+).
`get_keyframe_mode`	read	Get the current keyframe mode in Resolve. Returns 0=ALL, 1=COLOR, 2=SIZING.
`get_layout_preset_list`	read	Get the names of all saved UI layout presets (Resolve 21.0.4+).
`get_lut_directories`	read	Report Resolve
`get_lut_file_capabilities`	read	What this server can do with LUT files, and what it refuses.
`get_media_pool_item_transcription`	read	Read the complete 21.1 transcription dictionary for one Media Pool item, including timed words.
`get_media_pool_unique_id`	read	Get the unique ID of the Media Pool.
`get_media_storage_files`	read	Get media and file listings in a given absolute folder path from Media Storage.
`get_media_storage_subfolders`	read	Get subfolders in a given absolute folder path from Media Storage.
`get_mounted_volumes`	read	Get list of mounted volumes displayed in Resolve
`get_normalize_audio_modes`	read	Read GetNormalizeAudioModes (documented on Resolve 21.1+).
`get_project_attributes_in_current_folder`	read	Get per-project attributes for every project in the current folder (Resolve 21.0.4+).
`get_project_folder_list`	read	Get list of folders in the current project folder location.
`get_project_preset_list`	read	Get list of available project presets.
`get_project_settings_presets`	read	Read GetProjectSettingsPresetList (documented on Resolve 21.1+).
`get_project_unique_id`	read	Get the unique ID of the current project.
`get_quick_export_render_presets`	read	Get list of available quick export render presets.
`get_render_codecs`	read	Get available codecs for a given render format.
`get_render_formats`	read	Get all available render formats.
`get_render_job_list`	read	Get list of all render jobs in the queue.
`get_render_job_status`	read	Get the status of a specific render job.
`get_render_resolutions`	read	Get available render resolutions for a format/codec combination.
`get_resolve_api_surface`	read	Counts and object list for the shipped typed stub. Needs no connection.
`get_resolve_version_fields`	write	Get DaVinci Resolve version as structured fields [major, minor, patch, build, suffix].
`get_selected_clips`	read	Get currently selected clips in the Media Pool.
`get_selected_timeline_items`	read	Get the timeline items currently selected in the timeline (Resolve 21.0.4+).
`get_still_label`	read	Get the label of a still in a gallery album.
`get_timeline_by_index`	read	Get a timeline by its 1-based index.
`get_timeline_item_fades`	read	Read GetFades (documented on Resolve 21.1+). Durations are in frames.
`get_timeline_item_output_blanking`	read	Read GetOutputBlanking (documented on Resolve 21.1+). Pixel coordinates; clips inheriting timeline blanking return an empty dict.
`get_timeline_item_speed`	read	Read GetSpeed (documented on Resolve 21.1+).
`get_timeline_item_type`	read	Read the native lowercase TimelineItem type documented on Resolve 21.1+.
`get_timeline_item_use_timeline_for_output_blanking`	read	Read GetUseTimelineForOutputBlanking (documented on Resolve 21.1+).
`get_timeline_matte_list`	read	Get list of timeline mattes for a timeline item.
`get_timeline_output_blanking`	read	Read GetOutputBlanking (documented on Resolve 21.1+). Pixel coordinates; clips inheriting timeline blanking return an empty dict.
`get_user_preferences_preset_list`	read	Get the names of all saved user-preferences presets (Resolve 21.0.4+).
`goto_parent_project_folder`	read	Navigate up one level in the project folder hierarchy.
`goto_root_project_folder`	read	Navigate to the root project folder.
`graph_apply_arri_cdl_lut`	write	Apply ARRI CDL and LUT to a timeline item
`graph_apply_grade_from_drx`	write	Apply a grade from a .drx file to a timeline item
`graph_get_lut`	read	Get LUT path on a node in the color graph.
`graph_get_node_cache_mode`	read	Get the cache mode of a node.
`graph_get_node_label`	read	Get the label of a node.
`graph_get_num_nodes`	read	Get number of nodes in the color graph for a timeline item.
`graph_get_tools_in_node`	read	Get list of tools used in a node.
`import_burn_in_preset`	write	Import a burn-in preset from a file.
`import_cloud_project_tool`	write	Import a cloud project from a file.
`import_folder_from_file`	write	Import a Media Pool folder structure from a file.
`import_layout_preset_tool`	write	Import a layout preset from a file.
`import_media`	write	Import media into the current project
`import_project_from_file`	write	Import a project from a .drp file.
`import_render_preset`	write	Import a render preset from a file.
`import_stills_to_album`	write	Import stills from file paths into a gallery album.
`import_timeline_from_file`	write	Import a timeline from a file (AAF, EDL, XML, FCPXML, DRT, ADL, OTIO).
`import_user_preferences_preset`	write	Import a user-preferences preset from a file (Resolve 21.0.4+).
`insert_audio_to_current_track`	write	Insert audio file to current track at playhead position.
`inspect_custom_object`	read
`install_lut_file`	write	Install a LUT into the writable MCP folder under the master LUT root.
`is_rendering_in_progress`	read	Check if rendering is currently in progress.
`is_resolve_studio`	read	Read IsStudio (documented on Resolve 21.1+).
`link_clip_full_resolution_media`	read	Link full resolution media to a proxy clip.
`link_clip_proxy_media`	read	Link proxy media to a clip.
`link_proxy_media`	read	Link a proxy media file to a clip.
`list_lut_files`	read	List LUT files Resolve can see, with the path graph_set_lut accepts.
`list_timelines_tool`	read	List all timelines in the current project as a tool.
`modify_keyframe`	write	Modify an existing keyframe by changing its value or frame position.
`monitor_clip_growing_file`	read	Monitor a growing media file for the given Media Pool clip.
`move_clips_to_folder`	write	Move clips to a different Media Pool folder.
`move_media_pool_folders`	write	Move folders to a different Media Pool location.
`object_help`	read
`open_app_preferences`	read	Open the Preferences dialog in DaVinci Resolve.
`open_project`	read	Open a project by name.
`open_project_folder`	read	Open/navigate into a project folder.
`open_settings`	read	Open the Project Settings dialog in DaVinci Resolve.
`perform_clip_audio_classification`	read	Classify a clip
`project_read`	read	Read a Resolve Project.db as a database (READ-ONLY, zero-risk, no Resolve needed) — full offline introspection the scripting API can
`provenance`	read	Provenance / bookkeeping / audit (Cluster P) — the trust/defense layer. Report-only (gate: review). Actions: gallery_lineage (stills label convention SC##_approved_v## + albums + TIFF-for-VFX export plan), grade_provenance (
`read_lut_file`	read	Summarize a 3D .cube LUT: size, title, domain. Never the whole table.
`refresh_lut_list`	read	Refresh the LUT list in the project. Call after adding new LUT files.
`refresh_media_pool_folders`	read	Refresh all folders in the Media Pool.
`remove_lut_file`	destructive	Delete a LUT from the writable MCP folder only.
`rename_color_group`	write	Rename a color group.
`render_with_quick_export`	read	Render the current timeline using a Quick Export preset.
`restore_cloud_project_tool`	read	Restore a cloud project from a folder.
`restore_project`	read	Restore a project from an archive (.dra) file.
`reveal_in_media_storage`	read	Reveal a file path in Resolve
`save_as_new_render_preset`	write	Save current render settings as a new preset.
`save_layout_preset_tool`	write	Save the current UI layout as a preset.
`save_project`	write	Save the current project.
`save_user_preferences_preset`	write	Save the current user preferences as a named preset (Resolve 21.0.4+).
`search_resolve_api`	read	Search the shipped Resolve 21.1 typed API stub. Needs no connection.
`set_timeline_item_fades`	write	Set native 21.1 FadeIn and/or FadeOut as non-negative integer frame durations. Omitted fields remain native defaults/current state.
`set_timeline_item_speed`	write	Set native 21.1 Percentage, PitchCorrection, StretchKeyframesToFit and/or RippleTimeline. Percentage 0 freezes; RippleTimeline defaults false.
`setup_multicam_timeline`	write	Create a stacked multicam prep timeline from Media Pool clips.
`start_rendering_jobs`	write	Start rendering jobs. If no job IDs specified, renders all queued jobs.
`switch_page`	read	Switch to a specific page in DaVinci Resolve.
`ti_add_flag`	write	Add a flag to a timeline item.
`ti_add_fusion_comp`	write	Add a new Fusion composition to a timeline item.
`ti_add_marker`	write	Add a marker to a timeline item.
`ti_add_take`	write	Add a take to a timeline item.
`ti_add_version`	write	Add a new color version to a timeline item.
`ti_assign_to_color_group`	read	Assign a timeline item to a color group.
`ti_create_magic_mask`	write	Create a Magic Mask on a timeline item.
`ti_export_fusion_comp`	read	Export a Fusion composition to file.
`ti_export_lut`	read	Export LUT from a timeline item.

Trust audit

BLOCKgrade F · trust 50/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	WARN
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	WARN
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (15 observation(s))
Network: declared (9 observation(s))
Shell: declared (6 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHCode injection · code.deserialize · CWE-78, CWE-94, CWE-95

resolve-advanced/server/spec-compile.mjs:193

const doc = yaml.load(fs.readFileSync(file, 'utf8'));

Why it matters. deserialises untrusted bytes into live objects

Fix. use json or yaml.safe_load

MEDIUMInventory / provenance · inv.binary · CWE-1104

resolve-advanced/vendor/drp-format/templates/empty-project-r19.drp

empty-project-r19.drp

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInventory / provenance · inv.binary · CWE-1104

resolve-advanced/vendor/drp-format/templates/empty-project.drp

empty-project.drp

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

MEDIUMInformation disclosure · disclose.log_secret · CWE-209, CWE-532

src/utils/mcp_transport.py:242

print(f"davinci-resolve-mcp: bearer token for this session: {token}",

MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94

src/utils/image_qc.py:407

f"no flags, but the grade moved {round(shift, 2)} ΔE2000 "

MEDIUMObfuscation / stealth · obf.homoglyph · CWE-506, CWE-94

src/utils/image_qc.py:421

"reason": f"clean grade, {round(shift, 2)} ΔE2000 shift — nothing for vision to settle",

MEDIUMHard-coded secrets · secret.anthropic · CWE-798, CWE-321

tests/test_issue_report.py:80

"[email protected] sk-ant-api03-abcdefghijklmnopqrstuv api_key=hunter2 Bearer eyJhbGciOi.xx",

MEDIUMPrompt injection · prompt.conditional_escalation · CWE-94, CWE-1427

docs/SKILL.md:764

- `report_issue(kind, title, summary, ...)` — when the user says "send this as a

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

remove_lut_file, update_layout_preset

Why it matters. 2 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWInventory / provenance · inv.binary · CWE-1104

resolve-advanced/test/fixtures/E127_resolve_nested_export.drt

E127_resolve_nested_export.drt

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.binary · CWE-1104

resolve-advanced/vendor/drp-format/__tests__/fixtures/compound-nav-r21.drp

compound-nav-r21.drp

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.binary · CWE-1104

resolve-advanced/vendor/drp-format/__tests__/fixtures/p0-3-session30-empty-effectfilters.drp

p0-3-session30-empty-effectfilters.drp

Why it matters. a compiled or binary member cannot be reviewed from source

Fix. ship source, or explain the binary in the README

LOWInventory / provenance · inv.hidden_file · CWE-1104

.clinerules

.clinerules

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

.windsurfrules

.windsurfrules

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWInventory / provenance · inv.hidden_file · CWE-1104

resolve-advanced/.prettierrc.json

.prettierrc.json

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose

LOWCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

tests/test_granular_destructive_op.py:433

fn = getattr(__import__(f"src.granular.{path.stem}", fromlist=["x"]),

LOWCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

tests/test_granular_destructive_op.py:456

module = importlib.import_module(f"src.granular.{path.stem}")

LOWCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

tests/test_offline_guard_granular.py:124

common = importlib.import_module(GRANULAR_COMMON)

LOWCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

tests/test_offline_guard_granular.py:136

common = importlib.import_module(GRANULAR_COMMON)

LOWCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

tests/test_offline_guard_granular.py:147

module = importlib.import_module(name)

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

resolve-advanced/server/lineage-db.mjs:59

const sha1 = (s) => crypto.createHash('sha1').update(s).digest('hex');

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

resolve-advanced/server/project-db.mjs:23

const sha1 = (s) => crypto.createHash('sha1').update(s).digest('hex');

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

resolve-advanced/vendor/drp-format/media-template-cache.js:30

const key = crypto.createHash('sha1').update(path.resolve(mediaFilePath)).digest('hex');

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/analysis_dashboard.py:15475

etag = '"' + hashlib.md5(raw).hexdigest() + '"'

LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338

src/utils/color_grade_live_probe.py:188

return hashlib.md5(path.read_bytes()).hexdigest()

Gates applied: no_behavioural_pass.

Audited 2026-09-23 · audit v0.4.1 · source sha ba56de95aba0full audit observations/trust-audit/mcp-server/samuelgursky__davinci-resolve-1.json · Report an issue / request a re-scan

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

Date	Source	Verdict	Grade	Score	Change
2026-09-23	`ba56de95aba0`	BLOCK	F	50	score 52 -> 50
2026-09-19	`80eec60050e9`	BLOCK	F	52	first audit

Questions

What is the DaVinci Resolve MCP server?

MCP server integration for DaVinci Resolve Studio

What tools does DaVinci Resolve expose?

200 in total: 187 read-only, 83 that write, and 2 that can delete or overwrite (remove_lut_file). Every one is listed on this page with its risk.

Is DaVinci Resolve safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (50/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does DaVinci Resolve need?

It reads DAVINCI_MCP_TOKEN and PGPASSWORD from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does DaVinci Resolve run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as drt-format at 0.1.0.

How current is this page?

The grade is for one exact copy of the source (ba56de95aba0), read on 2026-09-23. The repository is watched and re-audited when it changes.

Source	samuelgursky/davinci-resolve-mcp
npm	`drt-format@0.1.0`
Transports	stdio · streamable-http
Credentials it reads	`DAVINCI_MCP_TOKENPGPASSWORD`
License	MIT
Activity	pushed 0d ago